CVE-2016-7781
CriticalSummary
Exponent CMS versions 2.3.9 and earlier have an SQL injection vulnerability in blogController.php. This allows remote attackers to execute arbitrary SQL commands via the 'author' parameter.
Risk Assessment
This vulnerability could lead to unauthorized access to the database, posing a serious threat to the integrity and confidentiality of the organization's data.
Recommendation
It is recommended to update Exponent CMS to the latest version to mitigate this vulnerability and implement additional security measures such as input validation.
Other vulnerabilities in Exponent CMS 2.3.9 i wcześniejsze
See all- CVE-2016-9087Critical
Exponent CMS versions 2.3.9 and earlier have an SQL injection vulnerability in filedownloadController.php. This allows remote attackers to execute arbitrary SQL commands via the fileid parameter.
- CVE-2016-9020Critical
CVE-2016-9020 is a SQL injection vulnerability in helpController.php in Exponent CMS version 2.3.9 and earlier. It allows remote attackers to execute arbitrary SQL commands via the version parameter.
- CVE-2016-9019Critical
CVE-2016-9019 is an SQL injection vulnerability in the activate_address function in addressController.php in Exponent CMS version 2.3.9 and earlier. It allows remote attackers to execute arbitrary SQL commands via the is_what parameter.
- CVE-2016-7789Critical
CVE-2016-7789 is a SQL injection vulnerability in expConfig.php in Exponent CMS version 2.3.9 and earlier. It allows remote attackers to execute arbitrary SQL commands via the apikey parameter.
- CVE-2016-7788Critical
Exponent CMS versions 2.3.9 and earlier have an SQL injection vulnerability in framework/modules/users/models/user.php that allows remote attackers to execute arbitrary SQL commands via the username parameter.
- CVE-2016-7784Critical
CVE-2016-7784 is an SQL injection vulnerability in the getSection function in expRouter.php in Exponent CMS version 2.3.9 and earlier. It allows remote attackers to execute arbitrary SQL commands via the section parameter.
- CVE-2016-7782Critical
CVE-2016-7782 is an SQL injection vulnerability in expConfig.php in Exponent CMS version 2.3.9 and earlier. It allows remote attackers to execute arbitrary SQL commands via the src parameter.
Original NVD description (English source)
SQL injection vulnerability in framework/modules/blog/controllers/blogController.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the author parameter.